Steve Gibson (97:47)
Yes. Okay. As I said, Chrome Web Store is a mess is the exact title someone who should know gave to a recent blog posting of his a few weeks ago, Wladimir Pallant. His posting caught my eye both Due to his pedigree and due to the importance of his message, anyone who's been following this podcast for more than a few years could probably reduce the number of major security trouble sources to a high single digit. And among those most important would be the security of web browser extensions. Because web browsers are the way we interface to the Internet and the rest of the world so much. You know, extensions to the basic functionality of our web browsers have been with us since nearly the beginning and 20 years ago, back when there was much less to do on the Internet, the security of an add on was much less critically important. In fact, the very first extensions didn't have any security. Mozilla created an extension mechanism and you really needed to trust the source of that code completely. But every year since then, more and more of our lives have moved online. This has meant that the overall security and privacy offered by the web browsers we use to interact with the Internet has become increasingly important. And no one who has listened to more than a couple of this podcast episodes could entertain any doubt that, disheartening though it might be, the world is apparently filled with an astonishing number of total strangers who would hurt us without a second thought to obtain any advantage. Several times in recent weeks I focused our attention upon the security and privacy issues surrounding web browser add ons. Sadly, there are many. So when I saw that Wladimir Pallant had taken the time to push back a bit from the entrails of specific add ons to survey the larger picture, I knew that was something I wanted to share. Earlier, I mentioned Vladimir's pedigree, but his name may not ring any bells right off. So here's how he explains himself on his blog site. He writes My name is Vladimir Pallant and I'm mostly blogging about security topics these days. You will often see me taking apart browser extensions because I've been developing those myself since 2003. One particularly well known project of mine is AdBlock plus, which I originally developed. Eventually I co founded IO, a company to take care of this project. I'm still developing the browser extension PfP Pain Free Passwords, while my other extensions have become obsolete over time. My writing is meant to help people learn, so I aim to provide information on both how vulnerabilities can be found and how how they can be prevented in your own code. I won't merely discuss security issues, but also try to draw generic conclusions from those and give recommendations. Despite researching security topics since at least 2007, I still do it as a hobby rather than my job. I experimented with earning money via bug bounty programs, which resulted in acceptable income. However, other aspects eventually turned me away from bug bounties. In particular, I want to write about my research and don't want to be prevented from it by a company taking years to fix an issue. Okay? In other words, he was becoming annoyed that after finding and reporting some problem and being paid for his responsible disclosure, the bug bounty agreement would require that he never reveal anything about the problem until after it had been fixed. This differs, of course, from unpaid security researchers who are able to set 90 day fix it before we publish it deadlines. So Vladimir was becoming annoyed that bugs were being purchased and he was being effectively gagged when he wanted to be able to document the problems and use them as illustrative teaching examples. In any event, here's a highly technical developer who created one of the earliest and most popular, popular and successful privacy extensions, who has been at this for more than 22 years. So when this guy titles his blog posting Chrome Web Store is a mess, I want to understand why he thinks so, Vladimir wrote. Let's make one thing clear first. I'm not singling out Google's handling of problematic and malicious browser extensions because it is worse than Microsoft's, for example. No, Microsoft is probably even worse, but I never bothered finding out. That's because Microsoft Edge doesn't matter. Its market share is too small. Google Chrome, on the other hand, is used by around 90% 90 90% of you users worldwide, and one would expect Google to take their responsibility to protect its users very seriously, right? After all, browser extensions are one selling point of Google Chrome, so certainly Google would make sure they're safe. Unfortunately, he writes, my experience reporting numerous malicious or otherwise problematic browser extensions speaks otherwise. Google appears to take the least effort required approach towards moderating Chrome Web Store. Their attempts to automate all things moderation do little to deter malicious actors, all while creating considerable issues for authors of legitimate add ons. Even when reports reach Google's human moderation team, the actions taken are inconsistent, and Google generally shies away from taking decisive actions against established businesses. As a result, for a decade my recommendation for Chrome users has been to stay away from Chrome Web Store if possible. Again, he writes. As a result, for a decade my recommendation for Chrome users has been to stay away from Chrome Web Store if possible, he said. Whenever extensions are absolutely necessary, it should be known who is developing them, why, and how the development is being funded. Just installing some extension from Chrome Web Store, including those recommended by Google as we'll see or featured is very likely to result in your browsing data being sold or worse. Google employees will certainly disagree with me. Sadly, much of it is organizational blindness. I'm certain, he says, that Google meant well and that they did many innovative things to make it all work. But looking at it from the outside, it's the result that matters. And for the end users, the result is a huge and rather dangerous mess. Okay, so some recent examples, he said. Five years ago I discovered that Avast browser extensions were spying on their users. That was he who discovered this. Remember we covered that at the time. It was a big deal. It's this guy who made the discovery, which may be why his name is at least some familiar to some of us, he continues. Mozilla and Opera disabled the extension that is Avast. The Avast browser extension listings immediately, he says, after I reported it to them. Google, on the other hand, took two weeks where they supposedly discussed their policies internally. The result of that discussion was eventually their no Surprises policy, which says building and maintaining user trust in Chrome Web Store is paramount, which means we set a high bar for developer transparency. All functionalities of extensions should be clearly disclosed to the user with no surprises. This means we will remove extensions which appear to deceive or mislead users, enable dishonest behavior, or utilize clickbaity functionality to artificially grow their distribution. Okay, so he says. So when dishonest behavior from extensions is reported today, Google should act immediately and decisively, right? Let's take a look at two examples that came up in the last few months. In October, he says. In October I wrote about the Reforest extension deceiving its users. I could conclusively prove that Colibri Hero, the company behind Reforest, deceives their users on the number of trees they supposedly plant, incentivizing users into installing with empty promises. In fact, they're a strong indication that the company never even donated for planting trees beyond a rather modest one time donation. Google got my report and dealt with it. What kind of action did they take? That's a very good question that Google won't answer. But Reforest is still available from Chrome Web Store, it is still featured, and it still advertises the very same completely made up numbers of trees they supposedly plant. Google even advertises for the extension, listing it in the Editor's Picks extensions collection. Probably the reason why it gained some users since my report. So much for being honest. For comparison, Reforest used to be available from Firefox add ons as well, but was already removed when I started my investigation. Opera removed the extension from their add on store within hours of my report. But maybe that issue wasn't serious enough after all, there's no harm done to users if the company is simply pocketing the money they claim to spend on a good cause. So Also in October I wrote about the Karma extension spying on users. Users are not being notified about their browsing data being collected and sold, except for a note buried in their privacy policy. Certainly that's identical to the Avast case mentioned before, and the extension needs to be taken down to protect users. Again, Google got my report and dealt with it, and again I failed to see any result of their action. The Carma extension remains available on Chrome Web Store unchanged. It will still notify their server about every web page its users visit. The users still aren't informed about this. Yet their Chrome Web Store page continues to claim this developer declares that your data is not being sold to third parties outside of the approved use cases, a statement contradicted by the extension's own privacy policy. The extension appears to have lost its featured badge at some point, but now that's back note of course, Karma isn't the only data broker that Google tolerates in Chrome Web Store. I published a guest article today by a researcher who didn't want to disclose their identity, explaining their experience with BI Science Ltd. A company misleading millions of extension users to collect and sell their browsing data. This post also explains how Google's approved use cases effectively allow pretty much any abuse of users data. Neither Reforest nor Karma were isolated instances. Both recruited or purchased other browser extensions as well. These other browser extensions were turned outright malicious with Stell's functionality to perform affiliate fraud and or collect users browsing history. Google's reaction was very inconsistent here. While most extensions affiliated with Karma were removed from Chrome Web Store, the extension with the highest user numbers and performing affiliate fraud without telling their users was allowed to remain for some reason with reforest. Most affiliate extensions were removed or stopped using their Impact Hero SDK. Yet when I checked more than two months after my report, two extensions from my original list still appeared to include that after that hidden affiliate fraud functionality, and I found seven new ones that Google apparently didn't notice. As for the reporting process, you may be wondering if I reported these issues, why do I have to guess what Google did in response to my reports? Keeping developers who report in the dark is Google's official policy and he he quotes a pop up that he received that says hello developer, thank you again for reporting these items. Our team is looking into the items and will take action accordingly. Please refer to the possible enforcement actions and note that we are unable to comment on the status of individual items. Thank you for your contributions to the extensions ecosystem. Sincerely, Chrome Web Store Developer Support in other words, you you explicitly receive no feedback. As somebody who reports a problem to the Chrome Web Store, he says this is the same response I received in November after pointing out the inconsistent treatment of the extensions. A month later, the state of affairs was still that some malicious extensions got removed while other extensions with identical functionality were available for users to install, and I have no idea why that is. I've heard before that Google employees are not allowed to discuss enforcement actions, and your guess is as good as mine as to whom this policy is supposed to protect. Supposedly the idea of not commenting on policy enforcement actions is hiding the internal decision making process process from bad actors so that they don't know how to game the process. If that's the theory, however, it isn't working. In this particular case, the bad actors got some feedback, be it through their extensions being removed or through, you know, due to adjustments demanded by Google. It's only me, the reporter of these issues, who is left guessing. But this is a positive development. I've received a confirmation that both these reports are being worked on. This is more than I usually get from Google, which is silence and typically also no visible action either. At least until reports start circulating in media publications forcing Google to then act on it. But let's take a step back and ask ourselves, how does one report Chrome Web Store policy violations? Given how much Google emphasizes their policies? There should be an obvious way. In fact, there's a support document for reporting issues and when I started asking around, even Google employees would direct me to it. And he shows a bunch of radio buttons on this where the radio buttons are did not like the content, not trustworthy, not what I was looking for, felt hostile, content was disturbing and felt suspicious. And then it's highlighted with if you find something in Chrome Web Store that violates the Chrome Web Store terms of service or trademark or copied infringement, let us know. And then those were the radio button options. But Wladimir notes, he says this doesn't seem like the place to report policy violations. Even felt suspicious isn't right for an issue you can prove is a violation, he says. And unsurprisingly, after choosing this option, Google just responds with your abruce report has been submitted successfully. No way to provide any details, no asking for my contact details in Case they have questions, no context whatsoever, merely felt suspicious. This is probably fed to some algorithm somewhere which might result in I don't know what actually, judging by malicious extensions where users have been vocally complaining often for years, nothing whatsoever results. This isn't the way he says, you know, to do this right? And he says, well, there's another option listed in the document. If you think an item in the, in the Chrome Web Store violates a copyright or trademark, fill out this form. And he says, yes, Google seems to care about copyright and trademark violations, but a policy violation is neither. If we try the form, that is try to use this this form. Nevertheless, it gives us a promising selection. We have two options policy meaning a non legal reason to report content or legal reasons to report content. He says, finally, yes, policy reasons are exactly what we're after. Let's click that. And here comes another choice and there's only one. It's under select the reason you wish to report content and it has a radio button. Child sexual abuse material. Report images or videos involving a child under 18 engaging in sexually explicit behavior. He says, well, that's really the only option offered and I have questions. At the very least those are in what jurisdiction is child sexual abuse material a non legal reason to report content? And since when is that the only policy that Chrome Web Store has? He says we can go back and try legal reasons to report content, of course, but the options available are really legal issues, intellectual properties, court orders, or violations of hate speech law. So that's another dead end. He says. It took me a lot of asking around to learn that the real and well hidden way to report Chrome Web Store policy violations is Web Is Chrome Web Store one stop support? He says. I mean, I get it that Google must be getting lots of nonsense reports and they probably want to limit that flood that that flood somehow. But making legitimate reports almost impossible can't really be the way. In 2019, Google launched the Developer Data Protection Reward Program. DDPRP Data Developer Data Protection Reward program meant to address privacy violations in Chrome extensions. Its participation conditions were rather narrow for my taste. Pretty much no issue would qualify for the program, but at least it was a reliable way to report issues, which might even get forwarded internally. Unfortunately, Google discontinued this program in August of 2024. It's not that I'm very convinced of DDPRP's performance. I've used that program twice. First time I reported Keepa's data exfiltration. DDPRP paid me an award for the report, but from what I could tell, allowed the extension to continue unchanged. The second report was about the malicious PDF toolbox extension. The report was deemed out of scope for the program, but forwarded internally. The extension was then removed quickly, but that might have been due to the media coverage it received. The benefit of the program was that it was a documented way of removing reaching a human being at Google who would look at a problematic extension. Now it's gone. And what about the Web Store and their spam issue? He says in theory there should be no spam on Crow on Chrome Web Store. The policy is quite clear on that quote. We don't allow any developer related developer accounts or their affiliates to submit multiple extensions that provide duplicate experiences or functionality on the Chrome Web Store. That's what Vladimir considers spam spamming the store with essential with essentially identical apps, he says. Unfortunately, this policy's enforcement is lax at best. Back In June of 2023, I wrote about a malicious cluster of Chrome extensions. Yeah, he says. I listed 108 extensions belonging to a single cluster, pointing out their spamming in particular. Thirteen were almost identical video downloaders, nine almost identical volume boosters, nine almost identical translation extensions, five almost identical screen recorders. Definitely not providing individual value, he said. I've also documented the outright malicious extensions in this cluster, pointing out that other extensions are likely to turn malicious as well once they have sufficient user counts. And how did Google respond? The malicious extensions have been removed? Yes, but other than that, 96 extensions from my original list remained active in January 2025 and there were of course more extensions than my original report did not list. For whatever reason, Google chose not to enforce their anti spam policy against them. And that's merely one example. My most recent blog post documented 920 extensions using tricks to spam Chrome Web Store, most of them belonging to a few large extension clusters. As it turned out, Google was made aware of this particular trick a year ago, before my blog post already. And again, for some reason Google chose not to act. What about extension reviews? Can they be trusted? When you search for extensions in Chrome Web Store, many results will likely come from one of the spam clusters. But the choice to install a particular extension is typically based on reviews. Can at least these reviews be trusted? On the topic of moderation of reviews, Google says Google does not verify the authenticity of reviews and ratings, but reviews that violate our terms of service will be removed. And the important part of the terms of service, he writes, is your reviews should reflect the experience you've had with the content or service you're reviewing. Do not post fake or inaccurate reviews the same review multiple times, reviews for the same content from multiple accounts reviews to mislead other users or misleading manipulate the rating or reviews on behalf of others. Do not misrepresent your identity or your affiliation to the content you're reviewing now. You may be wondering how well these rules are being enforced. The obviously fake review on the Karma extension is still there three months after being posted. Not that it matters with their continuous stream of incoming five star reviews, he says. A month ago and I reported an extension to Google that despite having merely 10,000 users, received 19 five star reviews on a single day in September and only a single negative review since then, he says. I pointed out that it is a consistent pattern across all extensions of this account. For example, another extension with only 33, 030 users received nine 5 star reviews on the same day. It really doesn't get any more obvious than that. Yet all these reviews are still online. I actually, for what it's worth, have a picture of them. Sophia franklin September 29, 20245 stars solved all my proxy switching issues. Fast, reliable and free. Robert anthony same day, September 19, 20245 stars very user friendly and efficient for managing proxy profiles. Liz Berry Works like a charm. A must have for anyone using multiple proxies. Godwin Max no more digging through settings. This extension makes proxy switching so much easier. 5 stars Also Anthony Brookley 5 stars September 19th all of these the same day. Excellent proxy tool flexibility. Perfect for my needs. Going Kate five stars. Smooth performance and no issues switching between different proxies. Daty Max makes proxy management hassle free, simple and effective. Wow. So I I have a lot to say in reaction to what Wladimir is observing and reporting, but I'm holding. I'm holding that for a minute until he's finished. Still, I just. I wanted to note and I get I hear you laughing and chuckling Leo in the background. I understand. I want to note that the automated cleanup of clearly bogus reviews would be trivial to implement. Vladimir is made suspicious when an extension with 30 users acquires nine five star reviews all on the same day. Right? One wonders whether they were all posted from different accounts at the same IP address. Google would know, but even if not, the fraudulent pattern is glaringly obvious. And remember that it's more than likely that this conduct is also reflected in the operation of the extension itself. Someone who's unwilling to honestly earn a reputation for their extension is more likely to have ulterior motives for creating it in the first place. So if Google were to automate extension review cleanup, which again would be trivial for them to do. They would be reducing the damage being done through the fraudulent over promotion of less savory extensions because no trivial cleanup is happening. We need to wonder whether review spamming may be something Google doesn't mind despite the policy publicly posted, you know, to the contrary, you know, and they don't mind it even if it's actually clearly hurting Chrome's users because it's the spammy reviews that are going to have the unsavory actions against their users selling their their browsing histories, Wladimir says. And it isn't only fake reviews. The reforest extension incentivizes reviews, which violates Google's anti semiconductor spam policy, which says developers must not attempt to manipulate the placement of any extensions in the Chrome Web Store. This includes, but is not limited to inflating product ratings, reviews or install counts by legitimate by illegitimate means such as fraudulent or incentivized downloads, reviews and ratings, he Sundays. It's been three months and they're still allowed to continue. The extension gets a massive amount of overwhelmingly positive reviews, users get their fake trees and everybody is happy. Well, all other than the people trying to make sense of this meaningless of these meaningless reviews. With reviews being so easy to game, it looks like lots of extensions are doing it. Sometimes it shows a clearly inflated review count, sometimes it's the overwhelmingly positive or meaning meaningless content. At this point, any user ratings with the average above four stars is likely to have been messed with. And he said, what about featured extensions? He said, but at least the Featured badge is meaningful, right? It certainly sounds like somebody at Google reviewed the extension and considered it worthy of carrying the Featured badge. At least Google's announcement indeed suggests a manual review. They say Google team members manually evaluate each extension before it receives the badge, paying special attention to the following we got two points. First, adherence to Chrome Web Store's best practices guidelines, including providing an enjoyable and intuitive experience using the latest platform APIs and respecting the privacy of end users and second, a store listing page that is clear and helpful for users with quality images and a detailed description, he says. Yet, looking through 920 spammy extensions I reported recently, most of them carry the Featured Badge. Yes, even the endless copies of video downloaders, volume boosters, AI assistants, translators and such. If there's an actual manual review of these extensions, as Google claims, it cannot be thorough. To provide a more tangible example, the Chrome Web store currently has BlazeVPN Safum S A F U M Saphem VPN and Snap VPN extensions, all carrying the Featured Badge. These extensions, along with Ishan Ishaan Ishan vpn, which has barely any users, belong to the PDF toolbox cluster, which produced malicious extensions in the past. A cursory code inspection reveals that all four are identical and are in fact clones of Nucleus VPN which was removed from Chrome web store in 2021. And they also don't even work. No VPN connections succeed. The extension not working is something users of Nucleus VPN complained about, which the extension compensated for by loading it up with fake reviews. And again, all of these carry the Featured Extension badge. So it looks like the main criteria for awarding the Featured Badge are the things which can be easily verified automatically, like user count manifest v3 claims to respect privacy not even the privacy policy, merely the right checkbox was checked and a Chrome Web Store listing with all the necessary promotional images. Given how many such extensions are plainly broken, the requirements on the user interface and general extension quality don't seem to be too high, and providing unique functionality definitely is not on the list of criteria. In other words, if you're a Chrome user, the Featured badge is completely meaningless. It's no guarantee that the extension is not malicious, not even an indication. In fact, authors of malicious extensions will invest some extra effort to get the badge. That's because the website algorithm seems to weigh the badge considerably towards the extension's ranking.
